seed(RolePermissionSeeder::class); $this->seed(RolePermissionSeeder::class); foreach (PermissionCatalog::ROLE_DEFAULTS as $role => $permissions) { $user = User::factory()->create(['is_active' => true]); $user->assignRole($role); foreach ($permissions as $permission) { $this->assertTrue($user->can($permission), "{$role} is missing {$permission}"); } } } public function test_dashboard_endpoints_enforce_role_and_permission_matrix(): void { $this->seed(RolePermissionSeeder::class); $admin = User::factory()->create(['is_active' => true]); $supervisor = User::factory()->create(['is_active' => true]); $agent = User::factory()->create(['is_active' => true]); $admin->assignRole('admin'); $supervisor->assignRole('supervisor'); $agent->assignRole('agent'); $lead = Lead::create(['company' => 'مشتری پیگیری', 'first_name' => 'علی', 'last_name' => 'فردا', 'phone' => '09120000001', 'assigned_to' => $agent->id]); $futureFollowUp = FollowUp::create([ 'lead_id' => $lead->id, 'user_id' => $agent->id, 'created_by' => $supervisor->id, 'scheduled_at' => now()->addDays(3), 'status' => 'pending', 'is_overdue' => false, 'notes' => 'پیگیری آینده', ]); $this->actingAs($admin)->getJson('/api/dashboard/admin') ->assertOk() ->assertJsonStructure([ 'live_charts' => [ 'updated_at', 'lead_status', 'call_outcomes' => [['label', 'value', 'color']], 'performance' => [['label', 'value', 'color']], ], ]) ->assertJsonCount(3, 'live_charts.call_outcomes') ->assertJsonCount(5, 'live_charts.performance'); $this->actingAs($admin)->getJson('/api/dashboard/supervisor')->assertForbidden(); $this->actingAs($supervisor)->getJson('/api/dashboard/supervisor') ->assertOk() ->assertJsonPath('live_charts.performance.0.label', 'تبدیل فروش'); $this->actingAs($supervisor)->getJson('/api/dashboard/admin')->assertForbidden(); $this->actingAs($agent)->getJson('/api/dashboard/agent') ->assertOk() ->assertJsonPath('live_charts.call_outcomes.0.label', 'موفق') ->assertJsonPath('follow_up_widgets.next.0.id', $futureFollowUp->id) ->assertJsonPath('follow_up_widgets.next.0.lead.company', 'مشتری پیگیری'); $this->actingAs($agent)->getJson('/api/dashboard/admin')->assertForbidden(); $this->actingAs($agent)->getJson('/api/dashboard/supervisor')->assertForbidden(); } }